Well, I probably shouldn't have included the BMI stuff.  This was just a
sample and the problem was not limited to messages sent from that particular
domain.  However, it appears to have stopped now.  Perhaps the auto delete
functionality finally kicked in and whacked the account.  I checked for
those 2 domains you turned up, Pete, and neither of them are on the list.
Hmmm, oh well - at least it's stopped.  Thanks!  (BTW - is the "dig" command
a Unix thing?)

Darryl

Pete Weiss [mailto:[log in to unmask]] wrote:

This might be an email loop of some sort since the RETURN-PATH: does not
appear to be the original FROM:  it also has a 'mail' substring within
the userids portion which might be a global filter wildcard.

Note that the RETURN-PATH domain seems to be unrelated to the FROM: domain:

 dig 21cn.com any
; Ques: 1, Ans: 2, Auth: 2, Addit: 2
;; AUTHORITY RECORDS:
21cn.com.       164154  IN      NS      NS.GUANGZHOU.GD.CN.
21cn.com.       164154  IN      NS      DNS2.GZNET.COM.

Ready; T=0.04/0.05 08:21:52
 dig BMI.NET  any
; Ques: 1, Ans: 4, Auth: 4, Addit: 4
;
;; AUTHORITY RECORDS:
BMI.NET.        172800  IN      NS      NS.BMI.NET.
BMI.NET.        172800  IN      NS      BIGJOHN.BMI.NET.
BMI.NET.        172800  IN      NS      NWNEXUS.WA.COM.
BMI.NET.        172800  IN      NS      BOLERO.RAHUL.NET.

<snip>